VPS hacked? What to do next

What to if your VPS has been hacked

If you’ve confirmed that your VPS has been hacked, you need to act quickly to contain the damage and restore security. Here’s a step-by-step guide on what to do:

1. Disconnect your VPS from the internet (if possible)

To prevent further damage, temporarily disable network access if you can. This stops the hacker from doing more harm while you investigate and clean up.

If you can’t take the VPS offline, at least block external access by disabling SSH and other remote login methods.

2. Identify the extent of the breach

Try to determine what the hacker has done.

• Check for unauthorized users: Look for new user accounts that you didn’t create.
• Review log files: Check login records and file modifications to see what was accessed or changed.
• Inspect running processes: Look for unusual or resource-heavy processes that could be running malicious scripts.
• Monitor outgoing traffic: If your VPS has been hacked, it may be sending data to an external server.

3. Reset all passwords and remove unauthorized access

Change passwords for everything, including:

• Your root/admin account
• Any user accounts on the VPS
• Your VPS control panel (if you use one)
• Your database and application passwords
• Your SSH keys (if you use key-based authentication)

If you find unauthorized SSH keys in your server, remove them immediately.

4. Back up important data (carefully)

If your VPS contains important files or website data, back them up before making major changes. However, be cautious—if the hacker has modified or infected files, backing them up could mean saving compromised data. If possible, only back up clean files.

5. Restore from a clean backup (if available)

Restoring your VPS from a recent, clean backup from before the hack is the safest way to get your VPS back to a working state. Make sure your backup is malware-free before restoring.

6. Reinstall the operating system (if needed)

If you can’t fully clean the server, the best way to ensure the hacker is gone is to completely reinstall the operating system.

• If you use a control panel (like cPanel or Plesk), check if your hosting provider offers an OS reinstall option.
• After reinstalling, update everything (operating system, web server, database software, etc.) before restoring your website.

7. Secure your VPS to prevent future attacks

After recovering from the hack, take steps to harden your server security to prevent future VPS hacks:

• Keep software updated: Regularly update your VPS, web applications, and plugins to patch vulnerabilities.
• Use a firewall: Block unnecessary ports and limit SSH access to your IP or a small range of trusted IPs.
• Enable two-factor authentication (2FA): If your hosting provider offers 2FA, enable it for added security.
• Set up automatic security monitoring: Install security tools to detect suspicious activity early.
• Disable unnecessary services: If your VPS is running services you don’t use, turn them off to reduce the attack surface.
• Regularly back up your data: Store backups in a separate, secure location so you can recover quickly in case of another attack.

It’s also important to work with a reputable VPS hosting provider. At the very least, your server is only as secure as your hosting provider enables it to be. At best, a good VPS host will offer a range of security, monitoring, and backup features and services.

8. Monitor your VPS for suspicious activity

Even after securing your VPS, keep an eye on it for signs of future attacks. Review logs regularly, check for unauthorized logins, and set up alerts for unusual activity.